System Care Antivirus
This malware disables in place, genuine, anti-virus
Location of infected files
On Windows 7 systems the infected files can be found at C:\ProgramData\<random string of characters> and there are 3 files:
- Executable file
- Icon file
- Other file
Files may claim to have a creation date of 2002 and each file is named the same as the <random string of characters>.
- Via a different user account, with the infected user logged out, locate and rename the malware files
- Download appropriate anti-virus updates / tools and scan your computer.
- The free Sophos Virus Removal Tool may be useful here
- Fix installed anti-virus
- The malware will infect a computer but not start functioning (alerting the user and blocking programs) until an Internet connection is present
- The "other file" only appears after an Internet connection has been detected
- More to follow